A Timing-Based Scheme for Rogue AP Detection

Abstract

Abstract-This paper considers a category of rogue access points (APs) that pretend to be legitimate APs to lure users to connect to them. We propose a practical timing-based technique that allows the user to avoid connecting to rogue APs. Our detection scheme is a client-centric approach that employs the round trip time between the user and the DNS server to independently determine whether an AP is a rogue AP without assistance from the WLAN operator. We implemented our detection technique on commercially available wireless cards to evaluate their performance. Extensive experiments have demonstrated the accuracy, effectiveness, and robustness of our approach. The algorithm achieves close to 100 percent accuracy in distinguishing rogue APs from legitimate APs in lightly loaded traffic conditions, and larger than 60 percent accuracy in heavy traffic conditions. At the same time, the detection only requires less than 1 second for lightly-loaded traffic conditions and tens of seconds for heavy traffic conditions.

A Flexible Framework for Rogue Access Point Detection

“…The method described in [25] is a timing-based scheme and explores the expected two hops that happen when the user connects to the DNS server. They used Round Trip Time (RTT) to determine if an AP is legitimate or not.…”

A Flexible Framework for Rogue Access Point Detection

“…Time Interval [29] 2014 Passive Client-side [40] 2012 Passive Cipher types [11] 2012 Passive Duplicate RSSI [30] 2012 Passive ETsniffer (v2) [54] 2012 Active WiFihop [38] 2011 Active DNS server two hops (v2) [25] 2011 Active RAPiD [43] 2010 Passive ETsniffer (v1) [47] 2010 Active DNS server two hops (v1) [24] 2009 Active Active behavioral [10] 2008 Active Authentication + SVM [46] 2006 Active The fingerprint active model in [10] uses network discovery and takes advantage of security tools like Nmap 2 . The method sends a request frame and waits for the response from where it will be able to determine how the devices react to fragmented or manipulated frames.…”

Rogue Access Point Detection: Taxonomy, Challenges, and Future Directions

“…Packets are then relayed from the Evil-twins plug-and-play wireless card to the built-in wireless card. The Evil-twin AP is set up by an adversary to listen to users traffic as they browse the Internet, and to launch several attacks on the victims devices [4,[24][25][26]. The IEEE 802.11 standard states that WLAN clients must connect to the AP that has the strongest signal.…”

“…This sub-type seeks to insert an RAP into the WLAN simultaneously with the legitimate AP. In [4], a timing-based scheme was presented that detects RAPs that are injected through a Linux-based machine. In the attacking scenario, the RAP can change its identity by masquerading as the legitimate AP by spoofing the legitimate APs MAC address and SSID.…”